CVE-2021-36922
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB devices (Escalation of Privileges, Denial of Service, Code Execution, and Information…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB devices (Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.28% probability · 21th percentile
- CISA KEV
- Not listed
- Affected
- realtek/rtsupx usb utility driver
- Source
- cve@mitre.org
References
- https://www.realtek.com/images/safe-report/Realtek_RtsUpx_Security_Advisory_Report.pdfVendor Advisory
- https://www.sentinelone.com/resources/category/report/Not Applicable
- https://www.realtek.com/images/safe-report/Realtek_RtsUpx_Security_Advisory_Report.pdfVendor Advisory
- https://www.sentinelone.com/resources/category/report/Not Applicable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.